Remove conflicting pull secret from integration runner SA

The pull-only ec-main-pull secret covers the same registry path as the
push secret. When Tekton merges credentials, the pull-only one can win,
causing oras attach to fail with "unauthorized". The push secret includes
pull permission so removing the pull-only one loses nothing.

Ref: https://redhat.atlassian.net/browse/EC-2011

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: simonbaird

hack/create-dummy-its.sh

@@ -72,7 +72,37 @@ echo ""
 PUSH_SECRET="${PUSH_SECRET:-imagerepository-for-ec-main-cli-main-image-push}"
 INTEGRATION_SA="konflux-integration-runner"
 
-if oc get sa "${INTEGRATION_SA}" -n "${NAMESPACE}" -o json | grep -q "\"${PUSH_SECRET}\""; then
+# The pull-only secret "ec-main-pull" covers the same registry path as the
+# push secret. Tekton merges all SA secrets into a single docker config, and
+# if the pull-only credential wins the merge for that registry, oras attach
+# fails with "unauthorized". Removing the pull-only secret avoids the
+# conflict — the push secret includes pull permission so nothing is lost.
+PULL_SECRET="${PULL_SECRET:-ec-main-pull}"
+
+SA_JSON=$(oc get sa "${INTEGRATION_SA}" -n "${NAMESPACE}" -o json)
+
+if echo "${SA_JSON}" | python3 -c "
+import json, sys
+sa = json.load(sys.stdin)
+secrets = [s['name'] for s in sa.get('secrets', [])]
+print('found' if '${PULL_SECRET}' in secrets else 'not_found')
+" | grep -q "found"; then
+  echo "Removing pull secret '${PULL_SECRET}' from SA '${INTEGRATION_SA}' to avoid credential conflict"
+  INDEX=$(echo "${SA_JSON}" | python3 -c "
+import json, sys
+sa = json.load(sys.stdin)
+for i, s in enumerate(sa.get('secrets', [])):
+    if s['name'] == '${PULL_SECRET}':
+        print(i)
+        break
+")
+  oc patch sa "${INTEGRATION_SA}" -n "${NAMESPACE}" --type=json \
+    -p="[{\"op\":\"remove\",\"path\":\"/secrets/${INDEX}\"}]"
+else
+  echo "Pull secret '${PULL_SECRET}' not present on SA '${INTEGRATION_SA}' (already removed)"
+fi
+
+if echo "${SA_JSON}" | grep -q "\"${PUSH_SECRET}\""; then
   echo "Push secret '${PUSH_SECRET}' already linked to SA '${INTEGRATION_SA}'"
 else
   echo "Adding push secret '${PUSH_SECRET}' to SA '${INTEGRATION_SA}'"